What happened
On February 2, 2022 an attacker exploited a signature-verification flaw in Wormhole’s Solana contract, forged a guardian message and minted 120,000 wrapped ETH with no backing, then bridged most of it back to Ethereum (project's own account).
The bridge was paused and patched. A backing firm replenished the contract with 120,000 ETH to restore full collateral, and Wormhole offered a US$10 million bounty (project's own account).
Scale, from official records
- 120,000 wrapped ETH minted without backing (Wormhole’s own incident report, 2022-02-04)
The Canadian angle
Global reference case; no Canadian-specific angle sourced.
What broke
A smart-contract bug in signature verification on one side of the bridge.
What a user could have checked
- Audit history of the deployed contracts and the size of the bug bounty.
- Who stands behind the bridge if collateral disappears: here a backer stepped in, which is not guaranteed.
Recovery
Collateral was restored by a backing firm (project's own account).
Sources
- Wormhole incident report 02/02/22 — Wormhole (archived), 2022-02-04
Supports: 120k wETH, root cause, recapitalization, bounty (project account) · checked 2026-11-01